High level conclusions

Fuzzers reach 87.23% of cyclomatic complexity.

Fuzzers reach 81.22% of all functions.

Fuzzers reach 87.48% code coverage.

Reachability and coverage overview

Functions statically reachable by fuzzers

558 / 687

Cyclomatic complexity statically reachable by fuzzers

5897 / 6760

Runtime code coverage of functions

601 / 687

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: opus_repacketizer_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	8.77%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	52	91.2%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	20	opus_extension_iterator_init	call site: 00020	fprintf
1	14	opus_packet_parse_impl	call site: 00014	parse_size
1	16	LLVMFuzzerTestOneInput	call site: 00016	opus_repacketizer_out_range_impl
1	51	opus_repacketizer_out_range_impl	call site: 00051	encode_size

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_repacketizer_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	8.77%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	52	91.2%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	20	opus_extension_iterator_init	call site: 00020	fprintf
1	14	opus_packet_parse_impl	call site: 00014	parse_size
1	16	LLVMFuzzerTestOneInput	call site: 00016	opus_repacketizer_out_range_impl
1	51	opus_repacketizer_out_range_impl	call site: 00051	encode_size

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_repacketizer_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	8.77%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	52	91.2%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	20	opus_extension_iterator_init	call site: 00020	fprintf
1	14	opus_packet_parse_impl	call site: 00014	parse_size
1	16	LLVMFuzzerTestOneInput	call site: 00016	opus_repacketizer_out_range_impl
1	51	opus_repacketizer_out_range_impl	call site: 00051	encode_size

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_repacketizer_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	8.77%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	52	91.2%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	20	opus_extension_iterator_init	call site: 00020	fprintf
1	14	opus_packet_parse_impl	call site: 00014	parse_size
1	16	LLVMFuzzerTestOneInput	call site: 00016	opus_repacketizer_out_range_impl
1	51	opus_repacketizer_out_range_impl	call site: 00051	encode_size

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_projection_decoder_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	100	13.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	622	86.1%
All colors	722	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	87	silk_ResetDecoder	call site: 00087	opus_decoder_ctl
9	482	interp_bits2pulses	call site: 00482	ec_enc_uint
8	526	compute_qn	call site: 00526	stereo_itheta
6	474	interp_bits2pulses	call site: 00474	ec_enc_bit_logp
5	553	compute_theta	call site: 00553	ec_enc_bit_logp
5	580	exp_rotation	call site: 00580	op_pvq_search_sse2
5	586	extract_collapse_mask	call site: 00586	encode_pulses
4	571	quant_partition	call site: 00571	alg_quant
4	629	stereo_merge	call site: 00629	quant_band_stereo
3	83	opus_multistream_decoder_ctl_va_list	call site: 00083	opus_custom_decoder_ctl
3	145	silk_decoder_set_fs	call site: 00145	celt_fatal
3	539	bitexact_cos	call site: 00539	ec_encode

Runtime coverage analysis

Covered functions

213

Functions that are reachable but not covered

24

Reachable functions

237

Percentage of reachable functions covered

89.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	3
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	8
/src/opus/celt/mathops.h	3
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_multistream_decode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	114	15.0%
gold	[1:9]	1	0.13%
yellow	[10:29]	2	0.26%
greenyellow	[30:49]	2	0.26%
lawngreen	50+	641	84.3%
All colors	760	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	68	silk_ResetDecoder	call site: 00068	opus_decoder_ctl
10	615	exp_rotation	call site: 00615	op_pvq_search_c
9	504	interp_bits2pulses	call site: 00504	ec_enc_uint
9	555	celt_rsqrt_norm32	call site: 00555	frac_div32
6	496	interp_bits2pulses	call site: 00496	ec_enc_bit_logp
6	548	compute_qn	call site: 00548	stereo_itheta
6	583	compute_theta	call site: 00583	ec_enc_bit_logp
5	626	extract_collapse_mask	call site: 00626	encode_pulses
4	673	stereo_merge	call site: 00673	quant_band_stereo
3	44	celt_decoder_init	call site: 00044	celt_fatal
3	64	opus_multistream_decoder_ctl_va_list	call site: 00064	opus_custom_decoder_ctl
3	126	silk_decoder_set_fs	call site: 00126	celt_fatal

Runtime coverage analysis

Covered functions

220

Functions that are reachable but not covered

24

Reachable functions

243

Percentage of reachable functions covered

90.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	13
/src/opus/celt/mathops.h	8
/src/opus/celt/mathops.c	11
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1
/src/opus/./celt/arch.h	1

Fuzzer: opus_projection_decoder_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	155	17.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.22%
greenyellow	[30:49]	1	0.11%
lawngreen	50+	750	82.5%
All colors	908	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	721	normalise_residual	call site: 00721	encode_pulses
16	617	cubic_quant_partition	call site: 00617	ec_enc_uint
14	89	silk_ResetDecoder	call site: 00089	opus_decoder_ctl
9	527	interp_bits2pulses	call site: 00527	ec_enc_uint
8	560	clt_compute_extra_allocation	call site: 00560	ec_enc_depth
8	599	cubic_quant_partition	call site: 00599	ec_enc_uint
6	519	interp_bits2pulses	call site: 00519	ec_enc_bit_logp
6	671	compute_theta	call site: 00671	ec_enc_bit_logp
6	706	exp_rotation	call site: 00706	extract_collapse_mask
6	713	extract_collapse_mask	call site: 00713	encode_pulses
4	799	stereo_merge	call site: 00799	quant_band_stereo
3	85	opus_multistream_decoder_ctl_va_list	call site: 00085	opus_custom_decoder_ctl

Runtime coverage analysis

Covered functions

245

Functions that are reachable but not covered

33

Reachable functions

277

Percentage of reachable functions covered

88.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	5
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	21
/src/opus/celt/mathops.h	10
/src/opus/celt/mathops.c	13
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/arch.h	1

Fuzzer: opus_encode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	9.56%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.36%
lawngreen	50+	998	90.0%
All colors	1108	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	1025	alg_quant	call site: 01025	alg_unquant
10	914	interp_bits2pulses	call site: 00914	ec_dec_uint
9	54	opus_encoder_ctl	call site: 00054	opus_custom_encoder_ctl
9	176	opus_repacketizer_out_range_impl	call site: 00176	opus_packet_extensions_generate
9	234	check_control_input	call site: 00234	celt_fatal
4	978	compute_theta	call site: 00978	ec_decode
3	24	silk_VAD_Init	call site: 00024	celt_fatal
3	150	opus_packet_parse_impl	call site: 00150	parse_size
3	160	opus_packet_extensions_count	call site: 00160	opus_extension_iterator_next_repeat
3	164	skip_extension	call site: 00164	skip_extension_payload
3	186	opus_repacketizer_out_range_impl	call site: 00186	opus_packet_extensions_generate
3	252	silk_setup_resamplers	call site: 00252	celt_fatal

Runtime coverage analysis

Covered functions

357

Functions that are reachable but not covered

28

Reachable functions

337

Percentage of reachable functions covered

91.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	24
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	22
/src/opus/celt/modes.c	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/./celt/os_support.h	2
/src/opus/./celt/celt.h	2
/src/opus/./celt/mathops.h	3
/src/opus/celt/kiss_fft.c	6
/src/opus/./celt/arch.h	1
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/mathops.h	5
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/celt/mathops.c	1
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_multistream_encode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	169	13.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1058	86.2%
All colors	1227	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	1139	alg_quant	call site: 01139	alg_unquant
10	1028	interp_bits2pulses	call site: 01028	ec_dec_uint
9	294	opus_repacketizer_out_range_impl	call site: 00294	opus_packet_extensions_generate
9	352	check_control_input	call site: 00352	celt_fatal
9	1202	opus_encode_frame_native	call site: 01202	celt_encode_with_ec
7	106	opus_multistream_encoder_ctl_va_list	call site: 00106	opus_encoder_ctl
7	116	opus_multistream_encoder_ctl_va_list	call site: 00116	opus_encoder_ctl
7	379	silk_resampler	call site: 00379	silk_resampler_private_IIR_FIR
5	65	opus_encoder_ctl	call site: 00065	opus_custom_encoder_ctl
5	362	silk_Encode	call site: 00362	silk_init_encoder
5	563	silk_LP_variable_cutoff	call site: 00563	silk_LP_interpolate_filter_taps
4	370	silk_setup_resamplers	call site: 00370	silk_float2short_array

Runtime coverage analysis

Covered functions

377

Functions that are reachable but not covered

33

Reachable functions

364

Percentage of reachable functions covered

90.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	21
/src/opus/celt/mathops.c	1
/src/opus/src/opus_encoder.c	21
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	22
/src/opus/celt/modes.c	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/src/opus_multistream.c	4
/src/opus/./celt/celt.h	2
/src/opus/./celt/os_support.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	5
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_projection_encoder_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	307	22.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1072	77.6%
All colors	1380	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
22	1266	alg_quant	call site: 01266	alg_unquant
16	1108	celt_encode_with_ec	call site: 01108	ec_enc_depth
16	1144	quant_band	call site: 01144	cubic_quant_partition
13	119	opus_multistream_encoder_init_impl	call site: 00119	ms_get_preemph_mem
13	1247	normalise_residual	call site: 01247	encode_pulses
10	1078	interp_bits2pulses	call site: 01078	ec_dec_uint
9	332	opus_repacketizer_out_range_impl	call site: 00332	opus_packet_extensions_generate
9	1352	opus_encode_frame_native	call site: 01352	celt_encode_with_ec
8	185	opus_multistream_encode_native	call site: 00185	surround_analysis
8	390	check_control_input	call site: 00390	celt_fatal
8	1059	celt_encode_with_ec	call site: 01059	compute_vbr
7	106	opus_encoder_ctl	call site: 00106	opus_custom_encoder_ctl

Runtime coverage analysis

Covered functions

384

Functions that are reachable but not covered

55

Reachable functions

393

Percentage of reachable functions covered

86.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	1
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	23
/src/opus/celt/modes.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	7
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/./celt/celt.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	6
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/vq.c	16
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1

Fuzzer: opus_encode_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	121	9.88%
gold	[1:9]	5	0.40%
yellow	[10:29]	11	0.89%
greenyellow	[30:49]	4	0.32%
lawngreen	50+	1083	88.4%
All colors	1224	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	1118	alg_quant	call site: 01118	alg_unquant
10	930	interp_bits2pulses	call site: 00930	ec_dec_uint
9	56	opus_encoder_ctl	call site: 00056	opus_custom_encoder_ctl
9	237	check_control_input	call site: 00237	celt_fatal
7	968	ec_enc_depth	call site: 00968	ec_dec_depth
5	1005	cubic_synthesis	call site: 01005	cubic_unquant
4	1043	compute_theta	call site: 01043	ec_decode
3	24	silk_VAD_Init	call site: 00024	celt_fatal
3	153	opus_packet_parse_impl	call site: 00153	parse_size
3	163	opus_packet_extensions_count	call site: 00163	opus_extension_iterator_next_repeat
3	167	skip_extension	call site: 00167	skip_extension_payload
3	255	silk_setup_resamplers	call site: 00255	celt_fatal

Runtime coverage analysis

Covered functions

374

Functions that are reachable but not covered

29

Reachable functions

355

Percentage of reachable functions covered

91.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	24
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	23
/src/opus/celt/modes.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	7
/src/opus/./celt/os_support.h	2
/src/opus/./celt/celt.h	2
/src/opus/./celt/mathops.h	3
/src/opus/celt/kiss_fft.c	6
/src/opus/./celt/arch.h	1
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/mathops.h	6
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/vq.c	16
/src/opus/celt/mathops.c	1
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1

Fuzzer: opus_projection_encoder_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	212	16.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.07%
lawngreen	50+	1052	83.1%
All colors	1265	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	117	opus_multistream_encoder_init_impl	call site: 00117	ms_get_preemph_mem
11	1174	alg_quant	call site: 01174	alg_unquant
10	1063	interp_bits2pulses	call site: 01063	ec_dec_uint
9	330	opus_repacketizer_out_range_impl	call site: 00330	opus_packet_extensions_generate
9	1237	opus_encode_frame_native	call site: 01237	celt_encode_with_ec
8	183	opus_multistream_encode_native	call site: 00183	surround_analysis
8	388	check_control_input	call site: 00388	celt_fatal
7	104	opus_encoder_ctl	call site: 00104	opus_custom_encoder_ctl
7	140	opus_multistream_encoder_ctl_va_list	call site: 00140	opus_encoder_ctl
7	150	opus_multistream_encoder_ctl_va_list	call site: 00150	opus_encoder_ctl
7	218	opus_multistream_encode_native	call site: 00218	opus_encoder_ctl
7	414	silk_resampler	call site: 00414	silk_resampler_private_IIR_FIR

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

40

Reachable functions

375

Percentage of reachable functions covered

89.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	1
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	22
/src/opus/celt/modes.c	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/./celt/celt.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	5
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_encode_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	164	12.2%
gold	[1:9]	29	2.16%
yellow	[10:29]	40	2.98%
greenyellow	[30:49]	8	0.59%
lawngreen	50+	1101	82.0%
All colors	1342	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	1228	alg_quant	call site: 01228	alg_unquant
10	1015	interp_bits2pulses	call site: 01015	ec_dec_uint
9	56	opus_encoder_ctl	call site: 00056	opus_custom_encoder_ctl
9	265	check_control_input	call site: 00265	celt_fatal
9	1090	cubic_quant	call site: 01090	cubic_unquant
7	1053	ec_enc_depth	call site: 01053	ec_dec_depth
5	623	limit_warped_coefs	call site: 00623	silk_DIV32_varQ
4	1138	compute_theta	call site: 01138	ec_decode
4	1188	exp_rotation	call site: 01188	extract_collapse_mask
3	24	silk_VAD_Init	call site: 00024	celt_fatal
3	180	opus_packet_parse_impl	call site: 00180	parse_size
3	190	opus_packet_extensions_count	call site: 00190	opus_extension_iterator_next_repeat

Runtime coverage analysis

Covered functions

388

Functions that are reachable but not covered

31

Reachable functions

365

Percentage of reachable functions covered

91.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	24
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	25
/src/opus/celt/modes.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	5
/src/opus/src/analysis.c	8
/src/opus/./celt/os_support.h	2
/src/opus/./celt/celt.h	2
/src/opus/./celt/mathops.h	6
/src/opus/celt/kiss_fft.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/celt/mathops.c	13
/src/opus/celt/mathops.h	11
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	21
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_projection_decoder_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	133	15.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.48%
lawngreen	50+	696	83.5%
All colors	833	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	657	normalise_residual	call site: 00657	encode_pulses
14	89	silk_ResetDecoder	call site: 00089	opus_decoder_ctl
9	486	interp_bits2pulses	call site: 00486	ec_enc_uint
9	569	cubic_quant_partition	call site: 00569	ec_enc_uint
8	519	clt_compute_extra_allocation	call site: 00519	ec_enc_depth
6	478	interp_bits2pulses	call site: 00478	ec_enc_bit_logp
6	650	extract_collapse_mask	call site: 00650	encode_pulses
5	615	compute_theta	call site: 00615	ec_enc_bit_logp
4	558	cubic_quant_partition	call site: 00558	ec_enc_uint
4	636	quant_partition	call site: 00636	alg_quant
4	645	exp_rotation	call site: 00645	extract_collapse_mask
4	725	stereo_merge	call site: 00725	quant_band_stereo

Runtime coverage analysis

Covered functions

227

Functions that are reachable but not covered

32

Reachable functions

259

Percentage of reachable functions covered

87.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	16
/src/opus/celt/mathops.h	4
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_multistream_decode_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	133	16.4%
gold	[1:9]	1	0.12%
yellow	[10:29]	2	0.24%
greenyellow	[30:49]	1	0.12%
lawngreen	50+	671	83.0%
All colors	808	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	638	normalise_residual	call site: 00638	encode_pulses
14	70	silk_ResetDecoder	call site: 00070	opus_decoder_ctl
9	467	interp_bits2pulses	call site: 00467	ec_enc_uint
9	550	cubic_quant_partition	call site: 00550	ec_enc_uint
8	500	clt_compute_extra_allocation	call site: 00500	ec_enc_depth
6	459	interp_bits2pulses	call site: 00459	ec_enc_bit_logp
6	631	extract_collapse_mask	call site: 00631	encode_pulses
5	596	compute_theta	call site: 00596	ec_enc_bit_logp
4	539	cubic_quant_partition	call site: 00539	ec_enc_uint
4	617	quant_partition	call site: 00617	alg_quant
4	626	exp_rotation	call site: 00626	extract_collapse_mask
4	706	stereo_merge	call site: 00706	quant_band_stereo

Runtime coverage analysis

Covered functions

218

Functions that are reachable but not covered

32

Reachable functions

250

Percentage of reachable functions covered

87.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	16
/src/opus/celt/mathops.h	4
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_projection_decoder_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	114	14.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	671	85.4%
All colors	785	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	87	silk_ResetDecoder	call site: 00087	opus_decoder_ctl
10	634	exp_rotation	call site: 00634	op_pvq_search_c
9	523	interp_bits2pulses	call site: 00523	ec_enc_uint
9	574	celt_rsqrt_norm32	call site: 00574	frac_div32
6	515	interp_bits2pulses	call site: 00515	ec_enc_bit_logp
6	567	compute_qn	call site: 00567	stereo_itheta
6	602	compute_theta	call site: 00602	ec_enc_bit_logp
5	645	extract_collapse_mask	call site: 00645	encode_pulses
4	692	stereo_merge	call site: 00692	quant_band_stereo
3	83	opus_multistream_decoder_ctl_va_list	call site: 00083	opus_custom_decoder_ctl
3	145	silk_decoder_set_fs	call site: 00145	celt_fatal
3	588	bitexact_cos	call site: 00588	ec_encode

Runtime coverage analysis

Covered functions

229

Functions that are reachable but not covered

24

Reachable functions

252

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	13
/src/opus/celt/mathops.h	8
/src/opus/celt/mathops.c	11
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1
/src/opus/./celt/arch.h	1

Fuzzer: opus_multistream_decode_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	155	17.5%
gold	[1:9]	1	0.11%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.45%
lawngreen	50+	723	81.8%
All colors	883	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	702	normalise_residual	call site: 00702	encode_pulses
16	598	cubic_quant_partition	call site: 00598	ec_enc_uint
14	70	silk_ResetDecoder	call site: 00070	opus_decoder_ctl
9	508	interp_bits2pulses	call site: 00508	ec_enc_uint
8	541	clt_compute_extra_allocation	call site: 00541	ec_enc_depth
8	580	cubic_quant_partition	call site: 00580	ec_enc_uint
6	500	interp_bits2pulses	call site: 00500	ec_enc_bit_logp
6	652	compute_theta	call site: 00652	ec_enc_bit_logp
6	687	exp_rotation	call site: 00687	extract_collapse_mask
6	694	extract_collapse_mask	call site: 00694	encode_pulses
4	780	stereo_merge	call site: 00780	quant_band_stereo
3	46	celt_decoder_init	call site: 00046	celt_fatal

Runtime coverage analysis

Covered functions

236

Functions that are reachable but not covered

33

Reachable functions

268

Percentage of reachable functions covered

87.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	5
/src/opus/celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	21
/src/opus/celt/mathops.h	10
/src/opus/celt/mathops.c	13
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/arch.h	1

Fuzzer: opus_projection_encoder_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	213	15.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.14%
greenyellow	[30:49]	1	0.07%
lawngreen	50+	1156	84.2%
All colors	1372	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	117	opus_multistream_encoder_init_impl	call site: 00117	ms_get_preemph_mem
12	1273	alg_quant	call site: 01273	alg_unquant
10	1146	interp_bits2pulses	call site: 01146	ec_dec_uint
9	362	opus_repacketizer_out_range_impl	call site: 00362	opus_packet_extensions_generate
9	1344	opus_encode_frame_native	call site: 01344	celt_encode_with_ec
8	421	check_control_input	call site: 00421	celt_fatal
7	104	opus_encoder_ctl	call site: 00104	opus_custom_encoder_ctl
7	140	opus_multistream_encoder_ctl_va_list	call site: 00140	opus_encoder_ctl
7	150	opus_multistream_encoder_ctl_va_list	call site: 00150	opus_encoder_ctl
7	229	opus_multistream_encode_native	call site: 00229	opus_encoder_ctl
7	445	silk_resampler	call site: 00445	silk_resampler_private_IIR_FIR
6	183	opus_multistream_encode_native	call site: 00183	surround_analysis

Runtime coverage analysis

Covered functions

397

Functions that are reachable but not covered

37

Reachable functions

382

Percentage of reachable functions covered

90.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	12
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	24
/src/opus/celt/modes.c	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/./celt/celt.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	10
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	13
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_multistream_decode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	100	14.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.43%
greenyellow	[30:49]	1	0.14%
lawngreen	50+	593	85.0%
All colors	697	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	68	silk_ResetDecoder	call site: 00068	opus_decoder_ctl
9	463	interp_bits2pulses	call site: 00463	ec_enc_uint
8	507	compute_qn	call site: 00507	stereo_itheta
6	455	interp_bits2pulses	call site: 00455	ec_enc_bit_logp
5	534	compute_theta	call site: 00534	ec_enc_bit_logp
5	561	exp_rotation	call site: 00561	op_pvq_search_sse2
5	567	extract_collapse_mask	call site: 00567	encode_pulses
4	552	quant_partition	call site: 00552	alg_quant
4	610	stereo_merge	call site: 00610	quant_band_stereo
3	44	celt_decoder_init	call site: 00044	celt_fatal
3	64	opus_multistream_decoder_ctl_va_list	call site: 00064	opus_custom_decoder_ctl
3	126	silk_decoder_set_fs	call site: 00126	celt_fatal

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

24

Reachable functions

228

Percentage of reachable functions covered

89.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	3
/src/opus/celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	8
/src/opus/celt/mathops.h	3
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_multistream_encode_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	275	18.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1184	81.1%
All colors	1459	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	1340	alg_quant	call site: 01340	alg_unquant
20	1193	quant_band	call site: 01193	cubic_quant_partition
16	1157	celt_encode_with_ec	call site: 01157	ec_enc_depth
15	1314	normalise_residual	call site: 01314	encode_pulses
10	1127	interp_bits2pulses	call site: 01127	ec_dec_uint
9	328	opus_repacketizer_out_range_impl	call site: 00328	opus_packet_extensions_generate
9	387	check_control_input	call site: 00387	celt_fatal
9	1434	opus_encode_frame_native	call site: 01434	celt_encode_with_ec
8	1108	celt_encode_with_ec	call site: 01108	compute_vbr
7	108	opus_multistream_encoder_ctl_va_list	call site: 00108	opus_encoder_ctl
7	118	opus_multistream_encoder_ctl_va_list	call site: 00118	opus_encoder_ctl
7	412	silk_resampler	call site: 00412	silk_resampler_private_IIR_FIR

Runtime coverage analysis

Covered functions

399

Functions that are reachable but not covered

45

Reachable functions

392

Percentage of reachable functions covered

88.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	21
/src/opus/celt/mathops.c	13
/src/opus/src/opus_encoder.c	21
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	25
/src/opus/celt/modes.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	5
/src/opus/src/analysis.c	8
/src/opus/src/opus_multistream.c	4
/src/opus/./celt/celt.h	2
/src/opus/./celt/os_support.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	11
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	21
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_multistream_encode_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	264	19.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1078	80.3%
All colors	1342	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
22	1231	alg_quant	call site: 01231	alg_unquant
16	1073	celt_encode_with_ec	call site: 01073	ec_enc_depth
16	1109	quant_band	call site: 01109	cubic_quant_partition
13	1212	normalise_residual	call site: 01212	encode_pulses
10	1043	interp_bits2pulses	call site: 01043	ec_dec_uint
9	296	opus_repacketizer_out_range_impl	call site: 00296	opus_packet_extensions_generate
9	354	check_control_input	call site: 00354	celt_fatal
9	1317	opus_encode_frame_native	call site: 01317	celt_encode_with_ec
8	1024	celt_encode_with_ec	call site: 01024	compute_vbr
7	108	opus_multistream_encoder_ctl_va_list	call site: 00108	opus_encoder_ctl
7	118	opus_multistream_encoder_ctl_va_list	call site: 00118	opus_encoder_ctl
7	381	silk_resampler	call site: 00381	silk_resampler_private_IIR_FIR

Runtime coverage analysis

Covered functions

380

Functions that are reachable but not covered

48

Reachable functions

382

Percentage of reachable functions covered

87.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	21
/src/opus/celt/mathops.c	1
/src/opus/src/opus_encoder.c	21
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	23
/src/opus/celt/modes.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	7
/src/opus/src/opus_multistream.c	4
/src/opus/./celt/celt.h	2
/src/opus/./celt/os_support.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	6
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/vq.c	16
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1

Fuzzer: opus_projection_encoder_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	316	21.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.13%
greenyellow	[30:49]	2	0.13%
lawngreen	50+	1177	78.6%
All colors	1497	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	1375	alg_quant	call site: 01375	alg_unquant
20	1228	quant_band	call site: 01228	cubic_quant_partition
16	1192	celt_encode_with_ec	call site: 01192	ec_enc_depth
15	1349	normalise_residual	call site: 01349	encode_pulses
13	119	opus_multistream_encoder_init_impl	call site: 00119	ms_get_preemph_mem
10	1162	interp_bits2pulses	call site: 01162	ec_dec_uint
9	364	opus_repacketizer_out_range_impl	call site: 00364	opus_packet_extensions_generate
9	1469	opus_encode_frame_native	call site: 01469	celt_encode_with_ec
8	423	check_control_input	call site: 00423	celt_fatal
8	1143	celt_encode_with_ec	call site: 01143	compute_vbr
7	106	opus_encoder_ctl	call site: 00106	opus_custom_encoder_ctl
7	142	opus_multistream_encoder_ctl_va_list	call site: 00142	opus_encoder_ctl

Runtime coverage analysis

Covered functions

403

Functions that are reachable but not covered

52

Reachable functions

403

Percentage of reachable functions covered

87.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	13
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	25
/src/opus/celt/modes.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	5
/src/opus/src/analysis.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/./celt/celt.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	11
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	21
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_encode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	112	9.21%
gold	[1:9]	5	0.41%
yellow	[10:29]	3	0.24%
greenyellow	[30:49]	12	0.98%
lawngreen	50+	1084	89.1%
All colors	1216	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	1125	alg_quant	call site: 01125	alg_unquant
10	998	interp_bits2pulses	call site: 00998	ec_dec_uint
9	54	opus_encoder_ctl	call site: 00054	opus_custom_encoder_ctl
9	203	opus_repacketizer_out_range_impl	call site: 00203	opus_packet_extensions_generate
9	262	check_control_input	call site: 00262	celt_fatal
4	1067	compute_theta	call site: 01067	ec_decode
3	24	silk_VAD_Init	call site: 00024	celt_fatal
3	177	opus_packet_parse_impl	call site: 00177	parse_size
3	187	opus_packet_extensions_count	call site: 00187	opus_extension_iterator_next_repeat
3	191	skip_extension	call site: 00191	skip_extension_payload
3	213	opus_repacketizer_out_range_impl	call site: 00213	opus_packet_extensions_generate
3	280	silk_setup_resamplers	call site: 00280	celt_fatal

Runtime coverage analysis

Covered functions

373

Functions that are reachable but not covered

25

Reachable functions

344

Percentage of reachable functions covered

92.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	24
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	24
/src/opus/celt/modes.c	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/./celt/os_support.h	2
/src/opus/./celt/celt.h	2
/src/opus/./celt/mathops.h	6
/src/opus/celt/kiss_fft.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/celt/mathops.c	12
/src/opus/celt/mathops.h	10
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	13
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_multistream_encode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	172	12.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1162	87.1%
All colors	1334	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	1238	alg_quant	call site: 01238	alg_unquant
10	1111	interp_bits2pulses	call site: 01111	ec_dec_uint
9	326	opus_repacketizer_out_range_impl	call site: 00326	opus_packet_extensions_generate
9	385	check_control_input	call site: 00385	celt_fatal
9	1309	opus_encode_frame_native	call site: 01309	celt_encode_with_ec
7	106	opus_multistream_encoder_ctl_va_list	call site: 00106	opus_encoder_ctl
7	116	opus_multistream_encoder_ctl_va_list	call site: 00116	opus_encoder_ctl
7	410	silk_resampler	call site: 00410	silk_resampler_private_IIR_FIR
5	65	opus_encoder_ctl	call site: 00065	opus_custom_encoder_ctl
5	395	silk_Encode	call site: 00395	silk_init_encoder
5	403	silk_setup_resamplers	call site: 00403	silk_resampler
5	592	silk_LP_variable_cutoff	call site: 00592	silk_LP_interpolate_filter_taps

Runtime coverage analysis

Covered functions

393

Functions that are reachable but not covered

30

Reachable functions

371

Percentage of reachable functions covered

91.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	21
/src/opus/celt/mathops.c	12
/src/opus/src/opus_encoder.c	21
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	24
/src/opus/celt/modes.c	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/src/opus_multistream.c	4
/src/opus/./celt/celt.h	2
/src/opus/./celt/os_support.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	10
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/celt.h	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	13
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4